Image-Based Malware Classification Using Three-Channel Representation and EfficientNet

Literature Overview

The paper by Yang Chunyu and colleagues from Guizhou Normal University presents a method for classifying malware using image-based representation techniques combined with transfer learning. Published in the Journal of Wuhan University (Natural Science Edition) in 2022, this work addresses a persistent challenge in cybersecurity: the declining effectiveness of traditional signature-based detection methods against polymorphic and obfuscated malware variants. The authors propose converting malware binaries, byte bigrams, and LST files into three distinct grayscale images, which are then combined into a single three-channel color image for classification using the EfficientNet architecture. The study was supported by the National Natural Science Foundation of China (U1831131) and provincial-level science and technology programs.

Core Technical Approach

The fundamental innovation lies in the multi-modal image representation strategy. Rather than relying on a single feature extraction pathway, the authors generate three complementary grayscale images from different representations of the same malware sample:

• Binary representation: The raw executable bytes are arranged into a two-dimensional grayscale matrix, preserving the spatial distribution of opcode patterns and instruction sequences.
• Byte bigram representation: Adjacent byte pairs are mapped to grayscale values, capturing local byte-level correlations that reflect compilation patterns and code obfuscation techniques.
• LST file representation: Symbol table or listing file data is similarly converted into a grayscale image, encoding structural metadata about the malware's internal organization.

These three grayscale channels are then concatenated into a single RGB color image, where each channel carries independent but complementary information. This design philosophy mirrors the approach used in multispectral imaging in materials science, where different spectral bands reveal features invisible in any single channel.

Model Architecture and Transfer Learning

The authors selected EfficientNet as the backbone classifier due to its superior accuracy-to-computation ratio compared to ResNet and VGG16 architectures. EfficientNet employs compound scaling, which uniformly scales network depth, width, and input resolution based on a single compound coefficient. This results in a model with fewer parameters and lower floating-point operations (FLOPs) while maintaining competitive classification accuracy.

The transfer learning strategy involves two stages:

1. Pre-training: The EfficientNet model is initially trained on the ImageNet dataset (1.28 million natural images across 1,000 classes), learning general visual feature extraction capabilities including edge detection, texture recognition, and shape analysis.
2. Fine-tuning: The pre-trained weights are adapted to the malware classification task by updating all or most layers with a smaller learning rate, allowing the model to specialize in recognizing malware-specific visual patterns while retaining the general feature extraction knowledge acquired from ImageNet.

Performance Analysis

The experimental results demonstrate a classification accuracy of 97.22% across 20 malware families, which represents a meaningful improvement over baseline approaches. The following table summarizes the comparative performance:

The convergence speed advantage of fine-tuning over training from scratch is particularly notable. In engineering practice, this translates directly to reduced computational resource requirements and shorter development cycles, which is critical for organizations that need to update their detection models frequently as new malware variants emerge.

Engineering Practice Implications

While this research originates in the cybersecurity domain, several methodological principles are transferable to other engineering disciplines:

• Multi-modal feature fusion: The concept of combining multiple independent representations into a unified input vector is analogous to using multiple non-destructive testing methods (RT, UT, MT, PT) on the same weld joint to obtain complementary defect information.
• Transfer learning for domain adaptation: Pre-training on a large, diverse dataset and then fine-tuning on a smaller, domain-specific dataset is a generalizable strategy applicable to any classification problem where labeled domain data is scarce.
• Efficient architecture selection: The preference for models with fewer parameters and lower computational cost while maintaining accuracy is a universal engineering optimization principle, whether in signal processing, structural analysis, or quality inspection systems.

Key Observations and Reflections

The approach of converting binary data into visual representations is an elegant solution to the problem of applying computer vision techniques to non-visual data. However, the effectiveness of this method depends heavily on the quality and informativeness of the image representation. The choice of grayscale mapping function, image dimensions, and channel combination strategy all influence the final classification performance.

One concern is the generalizability of the results. The study tests on 20 malware families, but the malware ecosystem is constantly evolving. New obfuscation techniques, packers, and polymorphic engines could potentially defeat an image-based classifier that was trained on a limited set of samples. Robustness testing against adversarial perturbations and cross-version generalization would strengthen the claims made in this paper.

Another consideration is the interpretability of the model. data analysis classifiers are often treated as black boxes, making it difficult to understand why a particular sample was classified as malicious. In safety-critical applications, explainability is essential for building trust and for regulatory compliance. Techniques such as Grad-CAM or attention visualization could provide insight into which regions of the input image drive the classification decision.

Study Insights

This paper demonstrates that creative feature engineering combined with modern data analysis architectures can yield practical solutions for challenging classification problems. The three-channel image representation is a particularly clever idea that leverages the complementary information available in different data representations. The use of EfficientNet with transfer learning provides a computationally efficient path to high accuracy, which is essential for real-world deployment where computational resources may be constrained.

For engineers in other domains, the key takeaway is that multi-modal feature fusion and transfer learning are powerful paradigms that can be adapted to solve classification and detection problems across a wide range of application areas. The methodology of converting domain-specific data into visual representations and applying image classification techniques is a transferable strategy worth considering for other non-visual data classification challenges.